How SitesPlaced handles your keys
What happens to the passwords, tokens and API keys you paste when you connect Stripe, PayPal, Shippo, WhatsApp or anything else — and what we can and can't do with them.
Last updated 26 August 2026
Connecting Stripe, PayPal, Shippo, WhatsApp or Meta means pasting something private into our settings screen. That is a reasonable thing to hesitate over, so here is exactly what happens to it — in plain terms, with no security jargon.
The short version
- Your money never passes through us. Customers pay *your* payment account directly. We have no account in the middle, take no cut, and cannot pay ourselves out of your balance.
- Keys are encrypted before they are stored. Nobody browsing our database sees a usable key.
- Keys never reach a web page. They are removed from everything the browser is sent — including your own dashboard.
- We ask for the least powerful key available. Where a service offers a limited key, we ask for that one and tell you exactly which permissions to tick.
- Disconnect works instantly, and you can always revoke the key at the source too.
Where your money actually goes
This is the part that matters most, and it is structural rather than a promise. When a customer pays on your store, the payment goes from them to your Stripe, PayPal or Razorpay account. SitesPlaced does not hold a balance, does not take a percentage, and is not a step in the payment. There is no arrangement under which your money sits with us, so there is nothing for us to delay, deduct from or lose.
That is also why you connect your *own* accounts rather than us providing one: it keeps you as the merchant, with your own relationship, your own payout schedule and your own dispute process.
Encrypted before storage
Every secret you paste — a Stripe restricted key, a PayPal secret, a Shippo token, a WhatsApp access token — is encrypted with AES-256-GCM before it is written to our database. The encryption key lives in our server environment, not in the database, so a copy of the database on its own contains nothing usable.
Never in a web page
Website builders load your site's settings to render pages. If that included your keys, they would end up in the page's source code, where anyone could read them. We keep a single list of every credential field, and everything sent to a browser is filtered through it first — on your live store, and on your own dashboard. A new integration cannot be added without going through that same filter.
We ask for limited keys
Where a service lets you create a key that can only do certain things, we ask for that rather than the master key — and we tell you which specific permissions to enable.
- Stripe — we ask for a *restricted key* with four permissions, not your account's secret key. It cannot move money, read your customer list, or change your account settings. See Take card payments with Stripe.
- Razorpay — no key at all. You sign in at Razorpay and approve, and neither of us handles a secret.
- PayPal and Shippo — these services issue one credential per app or account, so there is no smaller version to ask for. Both can be deleted or regenerated on their side at any moment.
- WhatsApp — we ask for a token tied to your WhatsApp Business account only.
You can always check
Every service listed here has a page showing which keys exist and when each was last used. If you ever want to confirm nothing unexpected is happening, that page is the honest answer — not us.
Turning it off
Every integration has a Disconnect button. It deletes the stored credential immediately, and where we created something on your account — like Stripe's order-notification endpoint — it removes that too. Existing orders keep their records; only the connection goes.
You never have to trust the button alone. Deleting or regenerating the key inside Stripe, PayPal, Shippo or Meta stops it working straight away, whatever we do or don't do.
Who can see these settings
Only you. Integration settings sit behind your account login and are checked against the store's owner on every request — being signed in isn't enough, you have to own that store. We don't ask for your key over email or WhatsApp, and our support team will never ask you to send one. If a message claiming to be from us asks for a key or password, it isn't us.
Common questions
Can SitesPlaced take money from my payment account?
No. The keys we ask for don't include the ability to move money, and payments go directly to your account rather than through us. With Stripe you can verify this yourself: the restricted key we ask for has four permissions, none of which is payouts or transfers.
What if SitesPlaced is hacked?
Keys are encrypted, and the encryption key is not stored alongside them, so a stolen database is not a set of working credentials. If we ever had reason to believe keys were exposed, we would tell you and ask you to rotate them — that is the honest plan, and it's why every service here lets you regenerate a key in seconds.
Why does Stripe need a 'Webhook Endpoints' permission?
So we can set up order notifications for you. Without it, you would have to create the endpoint in Stripe manually and copy a signing secret across — the step people most often get wrong. It only allows managing notification endpoints; it cannot touch payments or payouts.
Do you store my customers' card numbers?
No, and we never see them. Card details are entered on Stripe's or PayPal's own payment page, not on your store. We receive only the result — paid or not — and the last few digits shown on your order.
Can I use a test key first?
Yes, for Stripe (rk_test_), PayPal (Sandbox mode) and Shippo (shippo_test_). Just remember to switch to the live one before you start selling — test credentials never move real money, and Shippo's test labels are not accepted by carriers.
Related articles
Didn't find what you needed?